CVE-2025-23006

The vulnerability (CWE-502) involves deserialization of data from an untrusted source without prior verification of its authenticity or integrity. An attacker can send a specially crafted payload to the AMC or CMC interface before the authentication stage. Under certain environmental conditions, processing such a payload by the application leads to execution of arbitrary commands at the operating system level of the device.

An unauthenticated remote attacker can take full control of the SMA1000 device by executing arbitrary system commands, which may lead to breach of confidentiality, integrity, and availability of data as well as the entire infrastructure managed by this device.

Patches available from the vendor must be applied immediately in accordance with the official SonicWall security bulletin (SNWLID-2025-0002) available at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002. Until the fix is deployed, it is recommended to restrict access to the AMC and CMC interfaces only to trusted IP addresses through firewall rules.

SonicWall SMA1000 — Appliance Management Console (AMC) and Central Management Console (CMC); including models SMA6200, SMA6210, SMA8200V — versions indicated in vendor references (SNWLID-2025-0002)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.